Overview
Live Discover allows you to check the devices that Sophos Central is managing, look for signs of a threat, or assess compliance.

New to Live Discover & Response queries?

See Getting Started In Live Discover - From Beginner to Advanced Query Creation

Make sure to also check out
⁃ Best Practices On Using Live Discover & Response Query Forum and Sophos EDR Threat Hunting Framework.
⁃ Query Corner Announcement and Master Index.

Notes:
If Sophos pre-defined queries aren't working, Sophos Support can help to ensure that data is uploaded from your devices to the Sophos Data Lake. Visit the support portal
For custom query assistance, please see Getting LD&R Community Support or contact Sophos Professional Services.
For more information on Live Discover, please check out our Product Documentation

Sophos Community XDR Queries on GitHub

Navigate to a category below to browse and submit a query

Browse Live Response and Discover Queries by Category
Latest Live Discover and Response Queries (All)

  • Query who has modified an Active Directory object

    Dennis Franz1
    • Compliance
    • Approved on
    • 4 Comments
    Hello, I am not sure if I am in the right place here. We need a query who changed an Active Directory object. E.g. who disabled or enabled a computer in AD. There are queries for user objects but I haven't found any for computer objects. Can...

  • Application Whitelist

    Sylvain_Roy
    • Device
    • Approved on
    • 0 Comments
    Combined the idea of loading a CSV from a local file: https://community.sophos.com/intercept-x-endpoint/i/query-tips/load-a-local-csv-file-or-remote-csv-file-as-a-virtual-table to compare a list of applications against installed applications, as a...

  • Checking For Print Spooler Vulnerabilities

    JeramyKopacko
    • Threat Hunting
    • Approved on
    • 0 Comments
    This query will search your endpoints for the following CVEs and their currently released patches: 2021-1675, 2021-34527, and 2021-34481. As of writing this, CVE-2021-34481 is considered still vulnerable and the recommended fix is to disable the print...

  • SeriousSam/HiveNightmare Hunting Query (Live Endpoint)

    reg1nleifr
    • Threat Hunting
    • Approved on
    • 2 Comments
    Hunting Query we've used for detecting suspicious processes exploiting the SeriousSAM Vulnerability. Depending on your environment you might see plenty false positives. A good idea might be to add valid processes to the query based on the sha256 value...

  • Ability to view URL's (warn, block) using EDR

    RaviSoni
    • Compliance
    • Approved on
    • 0 Comments
    This query will parse the Web Intelligence log files and display the URL's that users have visited or have attempted to visit, Category of the URL, Action was taken etc. This gives a rough idea of what users have visited on a specific date. Declare...

  • Add context to the Sophos Endpoint Health Status report with XDR

    AndrewMundell
    • Compliance
    • Approved on
    • 1 Comment
    BIG thanks to RaviSoni for all the hard work on the detail in this query. You can use the query below to get more context on the health status of Windows machines via Endpoint Live Discover. e.g. which area is causing a bad health (Service or Threat...

  • Check IP Journal against File Properties & Processes

    JeramyKopacko
    • Threat Hunting
    • Approved on
    • 0 Comments
    It may be useful to see what specific PID, program, syntax, etc and its threat scoring that has interacted with a specific IP. This is the final query from the Getting Started Recommended Read shared recently. ## DEFINE $$IPaddress$$ as IPaddress ...

  • EDR Query to list deleted files in a directory

    RogerNeal
    • Files
    • Approved on
    • 0 Comments
    Description We've been asked a few times if its possible to write a quick query to list files deleted in a particular directory. This query below is a modification of the existing File Access History Query to just show deleted files for a specified...

  • Printnightmare Hunting Query (Live Discovery/Windows)

    reg1nleifr
    • Threat Hunting
    • Under Review on
    • 0 Comments
    Similar to the Data Lake Query (which seems to be having issues since it's not detecting all dll files in all folders) we've also created a Live-Discovery Query for Windows Systems on the Printnightmare Vulnerability. The Query could be scheduled via...

  • Complete, no data sent

    Billiam N
    • Files
    • Complete on
    • 0 Comments
    Good Morning Sophos Fam, I'm just beginning to leverage SQL queries in the life of a Security Admin, and my question is when you receive a "Complete, no data sent" is it due to - The device doesn't match the query parameters? - Communication...
Unfiltered HTML